Splunk Search

Run a generating command over a set of values

burwell
SplunkTrust
SplunkTrust

I have a search that will return a number of search ids.

index=_audit | <various modifications>| table search_id

Example.. I end up with

search_id

1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7886_5E002618-3E1F-491E-88C9-516508A9DB66
1604617764.7887_5E002618-3E1F-491E-88C9-516508A9DB66

Now for each of search_id I want to do a rest call to find out information about the search

For example, for the first search_id I want to call:

| rest services/search/jobs/1604617764.7885_5E002618-3E1F-491E-88C9-516508A9DB66 splunk_server=local

Since | rest is a generating command, I can't figure out how to do this.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can use the map command

| map maxsearches=100 search="
  | rest services/search/jobs/$search_id$ splunk_server=local
  | table *
"

 https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Map

However, there are some runtime and performance limits that will affect how many ids you can run over.

Hope this helps

 

View solution in original post

burwell
SplunkTrust
SplunkTrust

The map command was exactly what I needed. And thanks for the correction of the services command (works with/without first /)

Also, if you have other fields you want to refer to in map use $field$

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use the map command

| map maxsearches=100 search="
  | rest services/search/jobs/$search_id$ splunk_server=local
  | table *
"

 https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Map

However, there are some runtime and performance limits that will affect how many ids you can run over.

Hope this helps

 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Hi
Map is exactly correct command for this kind of task. Small fix to your example “rest /services/...” for someone else who are not so familiar with splunk.
r. Ismo
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!